CVE-2025-67254
📋 TL;DR
NagiosXI 2026R1.0.1 build 1762361101 contains a directory traversal vulnerability in /admin/coreconfigsnapshots.php that allows attackers to access files outside the intended directory. This affects NagiosXI administrators and potentially exposes sensitive system files. The vulnerability requires administrative access to exploit.
💻 Affected Systems
- NagiosXI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attackers with admin credentials could read sensitive system files like /etc/passwd, configuration files, or application secrets, potentially leading to privilege escalation or further system compromise.
Likely Case
Malicious administrators or compromised admin accounts could access sensitive configuration files, potentially exposing credentials or system information.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrators who should already have access to sensitive files.
🎯 Exploit Status
Exploitation requires administrative credentials but is technically simple once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.nagios.org/
Restart Required: No
Instructions:
1. Monitor Nagios official channels for security updates
2. Apply vendor patch when available
3. Verify fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Restrict Admin Access
allLimit administrative access to NagiosXI to only trusted personnel and implement strong authentication controls.
Web Application Firewall Rules
allImplement WAF rules to block directory traversal patterns in requests to /admin/coreconfigsnapshots.php.
🧯 If You Can't Patch
- Implement strict access controls and monitor admin user activity
- Restrict file system permissions for the NagiosXI web application user
🔍 How to Verify
Check if Vulnerable:
Test if authenticated admin user can access files outside web root via /admin/coreconfigsnapshots.php with traversal sequences.Check Version:
Check NagiosXI version in web interface or via system package managerVerify Fix Applied:
Test the same traversal attempts after applying vendor patch or workarounds to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Multiple failed traversal attempts
- Access to /admin/coreconfigsnapshots.php with traversal sequences
Network Indicators:
- HTTP requests containing ../ or similar traversal patterns to the vulnerable endpoint
SIEM Query:
web.url:*coreconfigsnapshots.php* AND (web.url:*../* OR web.url:*..\*)